If I understand correctly section 4.2 in Jacques Stern, David Pointcheval, John Malone-Lee, and Nigel P. Smart's Flaws in Applying Proof Methodologies to Signature Schemes, in proceedings of Crypto 2002, they describe an attack that allows premeditated substitution of ECDSA-signed message by the signer.
Per their notation, one can
- Freely decide any two messages m1, m2 ; say large files.
- Craft (using the article's method) an apparently normal ECDSA public-private key pair (y,x) and signature (r,s) such that both m1 and m2 verify against (y,x) and (r,s) !
- Distribute the public key y or obtain a certificate for it, in the usual way (including signing the Certificate Signing Request with the private key x as necessary).
- Optionally, use the private key x normally to sign various messages, with the signatures verifying normally.
- Put message m1 online and send to a verifier it's signature (r,s), invitation to check it, and indication that m1 will stay online.
- Later (after the logs on the server have shown m1 was read once by the verifier), change m1 to m2 and from then on stand firm on the position m2 what was there in the first place.
Is there something I miss? A documented case where what the paper describes has lead to disaster or dispute? A common mitigation?
I have not found a way to confound the perpetrator from m2, (r,s), y, or even with x on top of that. Surest mitigation seems to be keeping a copy of m1, which could give some degree of confidence to a third party expert that the signer was malicious. But that's impractical for large messages, and might not be an option for legal reasons. Keeping the hash h1 of m1 is feasible for the verifier, but I don't see that's enough to convince a third party.
Is there a well-known name for the security property an ideal signature scheme (and AFAIK EdDSA) has w.r.t. such attack, but ECDSA fails to have here?